Description
The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HashiCorp | Shared library | 1.0.1 – < 2.2.4 | 2.2.4 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-github-hashicorp-go-getter | 1.8.9-1 | — |
| Debian 12 | golang-github-hashicorp-go-getter | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | golang-github-hashicorp-go-getter | No fix yet | — |
| Ubuntu 22.04 LTS | golang-github-hashicorp-go-getter | No fix yet | — |
| Ubuntu 20.04 LTS | golang-github-hashicorp-go-getter | No fix yet | — |
| Ubuntu 18.04 LTS | golang-github-hashicorp-go-getter | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grype | 0.118.0-0.2.hum1 | RHSA-2026:68255 |
| Red Hat Hardened Images 1 | opentofu1.10 | 1.10.10-0.4.hum1 | RHSA-2026:68259 |
| Red Hat Hardened Images 1 | opentofu1.12 | 1.12.6-0.2.hum1 | RHSA-2026:68261 |
| Red Hat Hardened Images 1 | syft | 1.51.1-0.2.hum1 | RHSA-2026:68251 |
| Red Hat Hardened Images 1 | trivy | 0.74.0-0.3.hum1 | RHSA-2026:68281 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | terraform-provider-susepubliccloud | 0.0.1-150100.3.26.1 | SUSE-SU-2026:4444-1 |
| SLES 15 SP4 | terraform-provider-susepubliccloud | 0.0.1-150100.3.26.1 | SUSE-SU-2026:4444-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | packer | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | k9s | 0.51.0-r29 | — |
| Wolfi rolling | kubescape | 4.0.20-r2 | — |
| Wolfi rolling | opentofu-1.12 | 1.12.12-r2 | — |
| Wolfi rolling | opentofu-1.9 +1 | No fix yet | — |
| Wolfi rolling | snyk-cli | 1.1308.4-r1 | — |
| Wolfi rolling | steampipe | 2.4.9-r2 | — |
| Wolfi rolling | terraform | 1.5.7-r69 | — |
| Wolfi rolling | tflint | 0.65.0-r2 | — |
| Wolfi rolling | tfsec | 1.28.14-r59 | — |
| Wolfi rolling | xeol | 0.10.8-r73 | — |
| Wolfi rolling | zarf | 0.89.0-r4 | — |
Advisories 6
- RHSA-2026:68281 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- SUSE-SU-2026:4444-1 Security update for terraform-provider-susepubliccloud SUSE / openSUSE Security Updates · Oct 5, 2026
- RHSA-2026:68261 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Sep 22, 2026
- RHSA-2026:68255 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Sep 22, 2026
- RHSA-2026:68259 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Sep 22, 2026
- RHSA-2026:68251 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Sep 22, 2026